Posted by
Grim..., around May 2005:
If I've got a folder, called (say) 'private', how do I stop the general public viewing it's contents by doing something like http:\\mysite.com/private/privatedoc1.htm ?
I thought that changing the folders CHMOD settings to 711 would solve the problem but apparently not...
chmod changes the file permissions for users on the server. only one user reads the file for serving it on the web (apache, or your httpd), so you can't use chmod to make invisible, unless you want ot to be invisible to everyone via the web (chown user-who-is-not-apache && chmod 700).
to password protect or ip restrict a folder with apache, you'll need to set up a .htaccess file (assuming your server config allows it).
Posted by
Brock, around June 2005:
Pull your network lead out your comp, Grim. That'd do it.
What? It would!
Look up htaccess and htpasswd . Very simple.
Posted by
Grim..., around June 2005:
Can't use htaccess.
Hmm.
If I needed one of the files to be called by a php include(), could I set the chmod of 700?
no. either the web server can read it, or it can't
why not put the file outside of the webroot, and php include() it if a password is sent.
Posted by
Grim..., around June 2005:
The deal is that I was just wondering if there was a way to keep config files (holding database passwords, etc) more securly for webapps that other people can upload to their own webspace.
I think I am worrying too much =]
it's a very valid concern. the easiest way is to make them a .php file, so they get interpreted, rather then displayed verbatim. the following file, if named config.php, wont appear in a browser:
<?php
$config = array(
'foo' => 'bar',
'baz' => 'quux',
);
?>
Posted by
Grim..., around June 2005:
Yes, all the config stuff is in a .php file, but I remember that on one of my old forums you could trick it into uploading it's own config file (when you should be uploading an avatar or something), then somehow you could look at it.
I only wish I could remember
(a) how
(b) what I did about it...